Add CVE-2019-17546/{tiff,gdal}

tiff is already fixed for unstable since the 4.0.10+git190818-1 upload.

gdal itself uses the system libtiff library, but source-wise still
affected.